Multi cert chains (fixes #633).

letsencrypt/client.py

@@ -261,17 +261,22 @@ class Client(object):
                 "Non-standard path(s), might not work with crontab installed "
                 "by your operating system package manager")
 
-        # XXX: just to stop RenewableCert from complaining; this is
-        # probably not a good solution
-        chain_pem = "" if chain is None else OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, chain)
         lineage = storage.RenewableCert.new_lineage(
             domains[0], OpenSSL.crypto.dump_certificate(
                 OpenSSL.crypto.FILETYPE_PEM, certr.body),
-            key.pem, chain_pem, params, config, cli_config)
+            key.pem, self._dump_chain(chain), params, config, cli_config)
         self._report_renewal_status(lineage)
         return lineage
 
+    @staticmethod
+    def _dump_chain(chain, filetype=OpenSSL.crypto.FILETYPE_PEM):
+        # assumes that OpenSSL.crypto.dump_certificate includes ending
+        # newline character; XXX: returns empty string when no chain
+        # is available, which shuts up RenewableCert, but might not be
+        # the best solution...
+        return "".join(OpenSSL.crypto.dump_certificate(
+            filetype, cert) for cert in chain)
+
     def _report_renewal_status(self, cert):
         # pylint: disable=no-self-use
         """Informs the user about automatic renewal and deployment.
@@ -306,7 +311,7 @@ class Client(object):
         :param certr: ACME "certificate" resource.
         :type certr: :class:`acme.messages.Certificate`
 
-        :param chain_cert:
+        :param list chain_cert:
         :param str cert_path: Candidate path to a certificate.
         :param str chain_path: Candidate path to a certificate chain.
 
@@ -333,12 +338,11 @@ class Client(object):
         logger.info("Server issued certificate; certificate written to %s",
                     act_cert_path)
 
-        if chain_cert is not None:
+        if chain_cert:
             chain_file, act_chain_path = le_util.unique_file(
                 chain_path, 0o644)
             # TODO: Except
-            chain_pem = OpenSSL.crypto.dump_certificate(
+            chain_pem = self._dump_chain(chain_cert)
-                OpenSSL.crypto.FILETYPE_PEM, chain_cert)
             try:
                 chain_file.write(chain_pem)
             finally:

letsencrypt/storage.py

@@ -586,6 +586,8 @@ class RenewableCert(object):  # pylint: disable=too-many-instance-attributes
         with open(target["chain"], "w") as f:
             f.write(chain)
         with open(target["fullchain"], "w") as f:
+            # assumes that OpenSSL.crypto.dump_certificate includes
+            # ending newline character
             f.write(cert + chain)
 
         # Document what we've done in a new renewal config file